This vulnerability is a buffer overflow caused by the lack of validation of the length of user-supplied data in SETUP RTSP packets. Because the data is copied into a fixed-length buffer without bounds checking, an attacker can overflow the buffer and execute arbitrary code on the device. The flaw can be triggered from the network without any authentication, allowing remote attackers to gain full control of the Sony XAV‑9500ES device. The impact is the ability to run code, modify data, or take complete possession of the system.

The affected product is the Sony XAV‑9500ES media player. All installed units of this device model are impacted, as the vendor has not published a version distinction in the advisory. The firmware used by the device must be checked against the Sony support page for any available update.

The CVSS score of 8.8 indicates high severity. Exploitation does not require credentials and occurs over the network by sending a crafted RTSP SETUP packet. Although an EPSS score is not provided, the lack of authentication and the remote code execution capability suggest a significant threat. The vulnerability is not yet listed in CISA’s KEV catalog, but the high CVSS and proven remote exploitation mean it should be treated as a high‑risk vulnerability.